bc45d10e5447475486bb20b680f8a6ef164ff228e75419df79509e11454bf67c

General

Target
bc45d10e5447475486bb20b680f8a6ef164ff228e75419df79509e11454bf67c
Size 9.7MB
Sample260730-ll768sfb85
SHA256 bc45d10e5447475486bb20b680f8a6ef164ff228e75419df79509e11454bf67c
MD5 9b139e6d93d4307fe3dc3182ccbac1e0
SHA1 b929eb05725e9f74fe896038f16daf781703d03b
SHA512 23f4ca688959a170b62bf57e73b7440582f29430cf9674a8df15fc9c1b5ad985db2818f715212ab3aaac0ddaf8b400ef6094acfa21bdb74ad377dee5edacc597
SSDEEP 196608:3BjE9dxwvroDXrz5zxJPhyBln5Oi6cu/MRCrEe3Z5iN4lgW6S2sD+RQVmie:3WxwDGbz51KXJup3jc9bswue
TLSH
T10AA63342369B3802B137720EF1E0D99E65B99D47E65B9163BC9FE484ECD35AB271CC08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8011.msi
- Size 9.8MB
- SHA256 c4253111cd730a1df152290b72eecec22237983a9592786e2e6390bf401dd66c
- MD5 6c123666544438dc6c2f71dbc31aa1c2
- SHA1 68a62c96993bfa8f8f14a2f89d6a0835f882392a
- SHA512 405dc274836a6c1819bfc1c51c1542180fd7ef6e8ef1026d0c4851aa829391e62fa4ee0a1d70c350475582606e617d74a7fafeea1eb3520169a221f268b19d08
- SSDEEP 196608:Nsz4tlWBdX0N/o3uQjr9OBHCB1nbm0CEMJQRU9WWZF1EDC/SIzsiwPifQx4uy/:ezXX0xAt9Rj1MlZbMsbKoAy/
- TLSH
  T169A633C17DC72371E01BC376E181A5ADB13A7FC3BE228C1B7ADE75049DB222651B9A05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2